| suricata |
ET SCAN Behavioral Unusual Port 1433 traffic Potential Scan or Infection |
rev 16 |
2019-07-26 |
| suricata |
ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 4 |
rev 2 |
2019-07-26 |
| suricata |
ET EXPLOIT Possible Malicious NAT-PMP Response Successful TCP Map to External Network |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN NMAP SIP Version Detect OPTIONS Scan |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE HawkEye Keylogger Report SMTP |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB D$ share access |
rev 13 |
2019-07-26 |
| suricata |
ET EXPLOIT Possible CVE-2016-1287 Invalid Fragment Size Inbound 3 |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB RemoteActivation unicode little endian attempt |
rev 4 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE unicode SACL overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE Linux/ChinaZ DDoS Bot Checkin |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB InitiateSystemShutdown unicode attempt |
rev 6 |
2019-07-26 |
| suricata |
ET MALWARE Windows qwinsta Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
ET EXPLOIT Possible CVE-2015-7547 Long Response to A lookup |
rev 1 |
2019-07-26 |
| suricata |
ET SCAN Suspicious inbound to PostgreSQL port 5432 |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Executioner Ransomware Reporting Infection via SMTP |
rev 1 |
2019-07-26 |
| suricata |
ET SCAN Multiple FTP Root Login Attempts from Single Source - Possible Brute Force Attempt |
rev 3 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With No Profile Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS NT Trans NT CREATE DACL overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL RPC portmap NFS request UDP |
rev 8 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of arguments.callee %u UTF-8 Encoding |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Tapazom.A |
rev 1 |
2019-07-26 |
| suricata |
GPL RPC sadmind query with root credentials attempt UDP |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE NCSC XAgent itwm beacon v1 |
rev 1 |
2019-07-26 |
| suricata |
ET INFO Windows-Based OpenSSL Tunnel Outbound |
rev 5 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Gh0st Trojan CnC 2 |
rev 3 |
2019-07-26 |
| suricata |
ET EXPLOIT php script double base64 encoded Remote Code Execution 8 |
rev 2 |
2019-07-26 |
| suricata |
ET EXPLOIT php script double base64 encoded Remote Code Execution 2 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE W32/Dinwod.Dropper Win32/Xtrat.B CnC Beacon |
rev 5 |
2019-07-26 |
| suricata |
ET SCAN Multiple FTP Administrator Login Attempts from Single Source - Possible Brute Force Attempt |
rev 3 |
2019-07-26 |
| suricata |
ET EXPLOIT file_put_contents php base64 encoded Remote Code Execution 1 |
rev 2 |
2019-07-26 |
| suricata |
ET INFO WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB CoGetInstanceFromFile attempt |
rev 4 |
2019-07-26 |
| suricata |
ET SCAN Rapid POP3S Connections - Possible Brute Force Attack |
rev 7 |
2019-07-26 |
| suricata |
ET MALWARE Volatile Cedar Win32.Explosive CnC Beacon 3 |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS Session Setup NTMLSSP asn1 overflow attempt |
rev 21 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Microsoft Office Visio DXF File Processing Remote Code Execution |
rev 3 |
2019-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 2 |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB RemoteActivation attempt |
rev 4 |
2019-07-26 |